Tester's CSV uses 'cisecurity.org/recommendation' as the id header
— never matched any exact candidate, all 45 rows skipped.
Two-tier matching now:
1) exact candidate list (cis_id, recommendation #, section, …, plus
the new 'cisecurity.org/recommendation' explicitly)
2) substring fallback — any header containing 'recommendation',
'subsection' or 'section' is treated as cis_id when no exact
match was found. Picks up exotic shapes like 'CIS Subsection ID',
'Workbench Recommendation', URL-style 'cisecurity.org/...' etc.
Diagnose label flags substring matches explicitly so the operator
can verify which header was used, e.g.:
ID column used: cisecurity.org/recommendation (matched by substring)
Tester uploaded a 45-row CIS workbench CSV and got 'imported 0,
skipped 45' with no hint why. Two improvements:
1) Parser robustness
- cis_id candidates expanded: cis_id, recommendation #, section #,
control id, ref, # etc. (case-insensitive matched)
- title/impact candidates expanded to common variants
- strict regex still tries first; on miss, loose extractor pulls the
first 'N.N.N' token from cells like 'Section 1.1.1 Ensure ...'
or 'L1 2.3.4.1 ...'
2) Diagnostic stats
import response now also includes:
detected_headers — every column header found in the CSV
id_column_used — which header matched a cis_id candidate
impact_column_used — which header matched an impact candidate
preview — first 3 skipped rows with reason + sample
Frontend alert shows this diagnose block whenever imported = 0,
so the operator can see exactly which column the CSV is missing
without poking around with curl.
If the CSV header is something we still don't recognise (e.g. German
'Empfehlung' instead of 'recommendation'), the operator will see
'ID column used: (none recognised)' + the actual headers — easy to
file a follow-up with the right alias.
services/compliance_impact_import.py — flexible CSV parser that auto-
detects column shape so the tester's CIS-Benchmark exports work
without preprocessing:
cis_id ← cis_id|recommendation|section|id|control|ref
title ← title|description|name|recommendation_title
impact ← impact|score|weight|risk_score|risk
level ← level|profile|tier
benchmark ← benchmark|policy|os (else from filename)
Impact normalisation handles common CIS workbench shapes:
- 0-100 raw int → kept
- 0-10 risk score → auto ×10
- percent strings ('45%') → stripped
- garbage → 50 (neutral fallback)
Decoding tries UTF-8 then cp1252 (Excel on Windows German export),
delimiter sniffed across , ; tab |. Rows whose id doesn't look like
a CIS subsection (e.g. '2.3.4.1') are skipped with a counter.
Two new admin endpoints on the compliance router:
POST /api/v1/compliance/impacts/import multipart upload, RequireAdmin
GET /api/v1/compliance/impacts/stats per-benchmark count + avg
Idempotent upsert by (cis_id, benchmark) — re-uploads update existing
rows. Returns per-file stats so the operator sees exactly which rows
were skipped and why.
vulncheck