Vulcan

CI License Latest Release Docker Pulls

Vulcan is a comprehensive tool designed to streamline the creation of STIG-ready security guidance documentation and InSpec automated validation profiles. It bridges the gap between security requirements and practical implementation, enabling organizations to develop both human-readable instructions and machine-readable validation code simultaneously.

Vulcan models the Security Technical Implementation Guide (STIG) creation process, facilitating the alignment of security controls from high-level DISA Security Requirements Guides (SRGs) into STIGs tailored to specific system components. Content developed with Vulcan can be submitted to DISA for peer review and formal publication as official STIGs.

• 📋 STIG Process Modeling: Manages the complete workflow between vendors and sponsors
• 🔍 InSpec Integration: Write and test validation code locally or across SSH, AWS, and Docker targets
• 📊 Control Management: Track control status, revision history, and relationships
• 👥 Collaborative Authoring: Multiple authors can work on control sets with built-in review workflows
• 🔗 Cross-Reference Capabilities: Look up related controls across published STIGs
• 📚 STIG Library: View and reference DISA-published STIG content
• 🔒 Security: Database encryption for confidential data using symmetric encryption
• 🔑 Flexible Authentication: Support for local, GitHub, LDAP, and OIDC/OKTA providers
• 📬 Notifications: Email and Slack integration for workflow updates

# Pull the latest Docker image
docker pull mitre/vulcan:v2.4.2
# Or use docker compose for a complete setup
wget https://raw.githubusercontent.com/mitre/vulcan/master/docker-compose.yml
wget https://raw.githubusercontent.com/mitre/vulcan/master/setup-docker-secrets.sh
chmod +x setup-docker-secrets.sh
./setup-docker-secrets.sh
docker compose up

The first user to register becomes admin automatically.

For detailed release notes, see the Changelog.

• 📖 Full Documentation - the published copy of Vulcan's documentation site. A running Vulcan instance serves the same site at /docs. The site's About page is the authoritative project overview; installation, configuration, the user guide, and the API reference live there too.
• Security Guidance Training - MITRE SAF training course
• Contributing Guidelines

The documentation uses VitePress in docs/ with its own Vue 3 dependencies (isolated from the Rails app's Vue 2). All commands run from the project root:

yarn docs:dev # Dev server at http://localhost:5173/vulcan/
yarn docs:build # Build static site
yarn docs:preview # Preview production build

• Ruby 3.4.10 with Rails 8.1.3.1
• PostgreSQL 18 database
• Node.js 24 LTS for JavaScript runtime

• Vue 2.7.16 (separate instance per page — no shared SPA)
• Bootstrap 4.6.2 with Bootstrap-Vue 2.23.1
• Turbolinks 5.2.0 for navigation optimization
• esbuild for JavaScript bundling (replaced Webpacker)

• RSpec for Ruby backend testing
• Vitest for Vue component testing
• ESLint & Prettier for JavaScript linting
• RuboCop for Ruby style enforcement
• Brakeman for security scanning
• bundler-audit for dependency vulnerability scanning

• Docker with optimized UBI 9 production images (~529MB)
• GitHub Actions for CI/CD
• Heroku compatible
• SonarCloud integration for code quality

• Ruby 3.4.10 (use rbenv or rvm)
• PostgreSQL 18
• Node.js 24 LTS
• Yarn package manager

# Clone the repository
git clone https://github.com/mitre/vulcan.git
cd vulcan
# Install Ruby dependencies
bundle install
# Install JavaScript dependencies
yarn install
# Setup database
bin/setup
# Seed the database with sample data
rails db:seed
# Start the development server
foreman start -f Procfile.dev
# Or start services separately
rails server
yarn build:watch

Access the application at http://localhost:3000

# Run full backend suite (parallel — 3-4x faster than serial, capped at 8 workers)
bin/parallel_rspec spec/
# Run specific test file
bundle exec rspec spec/models/user_spec.rb
# Run frontend tests
yarn test:unit
# IMPORTANT: After running db:migrate, sync all parallel test databases.
# Parallel tests use separate databases (one per CPU core). New migrations
# only apply to the primary test DB — parallel:prepare propagates to all.
bundle exec rake parallel:prepare
# Run linters
bundle exec rubocop --autocorrect-all
yarn lint
# Security scanning
bundle exec brakeman
bundle exec bundler-audit

1. Generate secure configuration:

   ./setup-docker-secrets.sh
   # Choose option 2 for production

2. Configure environment (edit .env):

   • Authentication settings (OIDC/LDAP)
   • Application URL and contact email
   • SMTP configuration for notifications

3. Add SSL certificates (if behind corporate proxy):

   cp /path/to/certificate.pem ./certs/

4. Start the application:

   docker compose up -d

5. Database setup is automatic — db:prepare runs on container start via the Docker entrypoint. No manual step needed.

• Optimized size: ~529MB on Red Hat UBI 9 Minimal (Iron Bank / DISA aligned)
• Memory efficiency: jemalloc (compiled from source) + YJIT for 20-40% reduction
• Multi-stage builds for security and size (Ruby + jemalloc compiled in build stage, stripped before production COPY)
• Health checks configured
• Non-root user execution (UID 1000)

Vulcan v2.2+ includes automatic OIDC endpoint discovery — the essential configuration:

VULCAN_ENABLE_OIDC=true
VULCAN_APP_URL=https://your-vulcan-app.com
VULCAN_OIDC_ISSUER_URL=https://your-domain.okta.com/oauth2/default
VULCAN_OIDC_CLIENT_ID=your-client-id
VULCAN_OIDC_CLIENT_SECRET=your-client-secret
VULCAN_OIDC_REDIRECT_URI=https://your-vulcan-app.com/users/auth/oidc/callback

Register two URIs in your provider's app settings:

• Sign-in: <app_url>/users/auth/oidc/callback
• Sign-out: <app_url>/users/signed_out (required — providers reject Vulcan's logout without it)

See the Okta/OIDC setup guide in the documentation — a running instance serves it at /docs/deployment/auth/oidc-okta, and the published documentation carries the same page — for the full settings tables, verification checklist, and troubleshooting.

Supported providers:

• Okta
• Auth0
• Keycloak
• Azure AD
• Any OIDC-compliant provider

VULCAN_ENABLE_LDAP=true
VULCAN_LDAP_HOST=ldap.example.com
VULCAN_LDAP_PORT=636
VULCAN_LDAP_BASE=dc=example,dc=com
VULCAN_LDAP_BIND_DN=cn=admin,dc=example,dc=com
VULCAN_LDAP_BIND_PASSWORD=your-password

# Manual execution
bundle exec rails stig_and_srg_puller:pull
# Schedule in production (cron example)
0 2 * * * cd /app && bundle exec rails stig_and_srg_puller:pull

We welcome contributions! Please see our Contributing Guidelines for details.

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'feat: add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

• Follow Ruby style guide (enforced by RuboCop)
• Follow JavaScript style guide (enforced by ESLint)
• Write tests for new features
• Update documentation as needed
• Ensure all tests pass before submitting PR

• Vue 3 Migration: Modernize frontend framework
• Bootstrap 5 Upgrade: Update UI components
• Turbolinks Removal: Simplify navigation architecture
• API v2: Enhanced REST API with GraphQL support
• Multi-tenancy: Support for multiple organizations
• Advanced Reporting: Custom dashboards and metrics

See our detailed roadmap for more information.

• DISA for STIG and SRG specifications
• The InSpec community for validation framework
• All contributors who have helped improve Vulcan

• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Wiki: Project Wiki
• Security Issues: saf-security@mitre.org
• General Inquiries: saf@mitre.org

Vulcan is part of the MITRE Security Automation Framework (SAF), a comprehensive suite of tools and libraries designed to automate security validation and compliance checking.

• InSpec : Compliance automation framework
• Heimdall : Security results visualization
• SAF CLI : Command-line tools for security automation
• SAF Training : Training resources

Made with ❤️ by the MITRE Security Automation Framework team
A MITRE SAF Initiative