Monitoring and logs

oscap

Also OpenSCAP, SCAP, XCCDF, OVAL, compliance scan, vulnerability scanner, benchmark

Scans a host against a SCAP security baseline and reports each rule as pass or fail, with a severity.

oscap is OpenSCAP, the reference tool for SCAP content — the standard format security baselines are written in. oscap xccdf eval works through a benchmark's rules (an XCCDF document), checking each against the real host with an OVAL check, and prints pass or fail per rule. Run on the host itself it is a credentialed scan: it reads the actual configuration rather than guessing from outside. Each rule carries a severity, and rules can name a CVE and its CVSS score, so the output is a prioritised list of findings. The defender's loop is: eval, fix what failed, eval again until clean. --results FILE saves machine-readable results you can turn into a report with oscap xccdf generate report.

oscap command usage

oscap xccdf eval --profile PROFILE [--results FILE] [--rule RULE] BENCHMARK
oscap info BENCHMARK
oscap xccdf generate report --output FILE RESULTS

Options

--profile ID: which set of rules to check (a benchmark can hold several)
--results file.xml: save the machine-readable results
--rule ID: evaluate just one rule
info: show a benchmark's profiles and the check files it references
generate report --output r.html: turn saved results into a readable HTML report

oscap examples

oscap xccdf eval --profile xccdf_org.netlab_profile_baseline /root/baseline.xccdf.xml: Scans the host against the baseline and prints each rule as pass or fail.
oscap xccdf eval --profile xccdf_org.netlab_profile_baseline --results /root/scan1.xml /root/baseline.xccdf.xml: Runs the same scan and saves the results to a file.
oscap info /root/baseline.xccdf.xml: Lists the baseline's profiles and the check files it uses.

Reading the output

$ oscap xccdf eval --profile xccdf_org.netlab_profile_baseline /root/baseline.xccdf.xml
Title	Mitigate OpenSSH regreSSHion (CVE-2024-6387)
Rule	xccdf_org.netlab_rule_ssh_regresshion
Ident	CVE-2024-6387
Result	fail

Title	Disable direct SSH login as root
Rule	xccdf_org.netlab_rule_ssh_root_login
Result	pass

Result fail: the host does not meet that rule — a finding to remediate.
Ident CVE-2024-6387: the rule maps to a real CVE; look up its CVSS to prioritise.
Result pass: the host meets the rule; after remediation every rule should read pass.

Pitfalls

A run with any failing rule exits non-zero (2): that is 'findings present', not a tool error.
oscap xccdf eval prints the result but the severity lives in the benchmark — read it there (or in the HTML report) to prioritise.
Scan only hosts you run: this is defensive auditing of your own machine.

Run it on real machines