PROJECT / NETSTIG

Prove the network
is compliant.

netstig is a Python CLI for network operations and compliance teams. It connects to batches of network devices, pulls their running configurations, diffs them against known-good baselines, and generates compliance reports and ready-to-attach .ckl checklists for ATO packages.

Python 3.11+Netmiko · NAPALM · NornirTyper CLIMIT · v0.4.0 alpha
01 / WHY IT EXISTS

Manual evidence
doesn't scale.

Network STIG evidence usually means SSHing into every device, eyeballing configs, and hand-filling checklists — every ATO cycle. netstig started as an internal automation tool during the COVID era; this is its open-source reconstruction — same ideas, new code, public process.

BATCH DEVICE ACCESS

Multi-vendor connectivity

Connects to batches of switches, routers, and firewalls through Netmiko, NAPALM, and Nornir — plus a mock backend so the whole workflow runs without real hardware.

CONFIG SNAPSHOTS

Every device, on record

netstig pull fetches running configurations into per-host files, giving every audit a concrete, diffable artifact.

BASELINE DIFFS

Drift, made visible

Compares current configs against the last known-good snapshot, so unauthorized or accidental changes surface before an assessor finds them.

COMPLIANCE REPORTS

Four output formats

Maps device settings to STIG checklist entries and renders Markdown, HTML, CSV, or JSON reports for humans and pipelines alike.

CKL GENERATION

ATO-ready checklists

Emits multi-check .ckl files that attach directly to an ATO package — the artifact assessors actually ask for.

XCCDF IMPORT

DISA content, converted

Parses DISA XCCDF XML into YAML catalogs with platform auto-matching, so new STIG releases become runnable checks.

02 / WORKFLOW

Inventory to checklist
in four commands.

Every step is a plain CLI command — scriptable, repeatable, and dry-run friendly.

  1. STEP 01

    Initialize an inventory

    Scaffold a starter inventory — the mock connector lets you exercise the full workflow with no hardware.

    netstig init --mock
  2. STEP 02

    Pull running configs

    Fetch the running configuration from every device in the inventory into per-host snapshot files.

    netstig pull
  3. STEP 03

    Generate the report

    Render the compliance report in every format at once — Markdown, HTML, CSV, and JSON.

    netstig report --format all
  4. STEP 04

    Emit the checklist

    Produce the multi-check STIG checklist that attaches straight to the ATO package.

    netstig stig --stig-id cisco-ios-17 --output stig-checklist.ckl
STATUSv0.4.0 alphaPython 3.11+MIT licenseDocker imagemkdocs docs + CIPyPI packaging
03 / GET IN TOUCH

Want a closer look?

The repository is private while the tool stabilizes. If you'd like a walkthrough or want to talk network compliance automation, email me.

Email me about netstig