feat: extract CCI identifiers from XCCDF parsing

Andrew Dunnrequested to merge
feat/xccdf-cci-extraction into master

What does this MR do?

Extracts CCI (Control Correlation Identifier) values from XCCDF <ident> elements and threads them through the per-rule findings so they reach stig_evidence_map_*.json and stig_detailed_findings_*.txt as a new ccis field.

Why: CCIs are the join key from a STIG finding to its NIST Special Publication 800-53 control(s). The parser reads title, description, check-content and fixtext, but never read <ident> -- so CCIs were never available to anything consuming this tool's output, and compliance reporting that maps findings to controls needs that identifier.

What changed:

  • New extract_rule_ccis(rule, ns) filters <ident> elements to system="http://cyber.mil/cci", skipping the paired legacy V-/SV- idents (system="http://cyber.mil/legacy") that XCCDF exports carry alongside each CCI. Ident text is stripped since XCCDF_FILE is operator-configurable and some DISA exports pretty-print idents with surrounding whitespace; an empty-after-strip ident is excluded.
  • rules_catalog, compliance_findings, evidence_map, and the detailed findings text report now carry a ccis list per rule.
  • The .ckl export needed no change -- it already carries CCI_REF from the source checklist template. Cross-checked per-VULN against the extracted CCIs: 286/286 rules match exactly, zero disagreements (256 rules carry 1 CCI, 29 carry 2, 1 carries 5; 319 CCIs total).

Behavior: additive only. No existing field is renamed or removed, and nothing in the AI analysis prompt or verdict logic changes.

Testing: Ran CI's unittest discover command against a local checkout (-s tests; the CI job uses -s /tests, the path inside the analyzer image):

Ran 18 tests in 0.002s

OK

(11 pre-existing + 7 new: multi-CCI rules, legacy-only idents, no idents at all, an empty CCI ident, an ident with no system attribute, and whitespace-padded ident text.) pytest is not installed in CI; it was used only as a local convenience runner during development and reports the same result.

Related issues

N/A

Documentation updates

  • README.md -- the stig_detailed_findings_*.txt and stig_evidence_map_*.json artifact bullets now note they include per-rule CCI references.
  • CHANGELOG.md -- see below.

CHANGELOG.md updated

Added under ## [Unreleased]:

Added - CCI extraction from XCCDF

  • stig_evidence_map_*.json and stig_detailed_findings_*.txt now carry per-rule ccis (Control Correlation Identifiers extracted from XCCDF <ident> elements).

Checklist

  • README.md updated (if applicable)
  • CHANGELOG.md updated
  • Security documentation updated (if applicable) -- N/A, no security-related change
  • Usage examples added (for new features) -- N/A, extraction is automatic; there is no new input/config to document
  • Pipeline passes -- not yet run (branch not pushed); the local test run above is green

Merge request reports