In reply to Omar Santos.

Thanks Omar, I noticed today. Thanks!

I understood all IOS PSIRT notices will be issued to include OVAL files? Please correct if that asusmption wrong. That seams to be the case since ~2010 at least - prior to that they were in Mitre, and thats what was stated when Cisco sat on the OVAL standards board years ago.

I also was hoping the OVALs would be batch released in ZIP like in March - as per: https://supportforums.cisco.com/docs/DOC-35146

RE: NTP and RSVP technical issues.

Comes of a bit of suprise. There would be two options:- adding 'show running-config | include ^interface|ntp multicast' as new object, or checking object 1 (running config) for the line 'ntp multicast command'.

There are already about 20 odd be-spoke command outputs.. like 'show ip inspect | Match:xxxx in the FULL OVAL database. I know this since I compiled all Mitre (up to ~2010) and all Cisco IOS OVALS since then. I therefore collect all those commands output along with config, and much more easily check a few thousand IOS devices based on current config and OVAL requested command output. False positives goes down from around 40% based on IOS version alone, to about 6% with the show output. Then half of that 6% are incomplete OVALs matches, or platform not effected where OVAL schema has not platform field.

I wanted to do this twice a year aligned to the batch notices in March/Oct.. as particulary the banking and finance markets need this for compliance auditors. Having the zip files, OVAL in all cases.. obviously turns it into a few hours work twice a year.

For RSVP, something similar where config object checked for both RSVP and MPLS running. Would not be perfect, but nor is some of the exisiting ones. But seeing as not many enterprises run MPLS and/or RSVP - so this will still provide a 'false' for several hundred routers that would not need to be manually checked.

But please let me know if the plan is that it will be hit and miss for the customer being provided OVAL's. I should either stop my script developement and go back to manual process - or what makes better sense is a learn to write my own OVAL files for the ones without which I am happy to share.

Cheers,

Jason