Skip to content
Amndeep Singh Mann edited this page Jul 10, 2025 · 21 revisions

Welcome to the SAF CLI wiki!

The MITRE Security Automation Framework (SAF) Command Line Interface (CLI) brings together applications, techniques, libraries, and tools developed by MITRE and the security community to streamline security automation for systems and DevOps pipelines.


Content Description
Common Instructions
How to create a SAF CLI release Documents the process for creating a SAF CLI release
Splunk Configuration Documentation on how to configure Splunk to use with the hdf2splunk CLI
Supplement HDF Configuration Documentation on how to configure supplement (ex. read or modify) elements that provide contextual information in an HDF file such as passthrough or target
Validation with Thresholds Documentation about how to do Validation of compliance via the SA CLI
Developers Corner
Development Standards & References Provides guidance's and best practices when writing code for the SAF CLI
SAF CLI Delta Process Provides information about how to invoke the SAF CLI Delta process
Mapper Creation Guide for HDF Converters HDF Mapper and Converter Creation Guide (for SAF CLI & Heimdall2)
How to create a SAF CLI Documents the process for creating a SAF CLI
How to recommend development of a mapper Documentation on how to develop a mapper
Using an unreleased version of select packages from the SAF ecosystem in the SAF CLI Documentation on how to use an unreleased version (example: from a branch) of a package from the Heimdall monorepo or InSpec Objects in the SAF CLI
Troubleshooting List known issues while configuring and developing the SAF-CLI (WIP)
InSpec Profiles
How to generate InSpec Profile Structures Provides information about how to utilized the SAF CLI inspec_profile process to generate profile stubs
How to Create an InSpec Profile Release Documents the process for creating an InSpec Profile release
InSpec Profiles General Information Documents common information about InSpec profile controls (XCCDF/STIG Impact mappings and more)
Other Documentation
SAF-CLI Security Control Responses Based on the Application Security & Development STIG guidance

Clone this wiki locally