Blog
Turning DISA STIGs into risk-ranked remediation
stig-ai-pipeline is a vendor-neutral, MIT-licensed toolkit I maintain for turning a DISA STIG into something a team can actually work from.
A STIG ships as XCCDF. The useful output is a severity-ranked set of remediations in Markdown, JSON, or CSV, plus a plain-English explanation of each rule. The same project can check a machine against a STIG under a human approval gate so a scan does not become an unattended change.
The repository is public. I also wrote a longer walkthrough of packaging the XCCDF-to-Excel path as a reusable AI skill on HackerNoon.