OpenSCAP Deep Dive¶

Platform: Linux | Binary: oscap | Type: NIST-certified SCAP scanner

Overview¶

OpenSCAP is the most standards-compliant tool in CISentinel's arsenal. It evaluates systems against XCCDF (Extensible Configuration Checklist Description Format) benchmarks using SCAP Security Guide (SSG) content.

How CISentinel Uses OpenSCAP¶

1. Content Discovery¶

CISentinel automatically finds the correct SSG datastream file for your OS:

/usr/share/xml/scap/ssg/content/
├── ssg-ubuntu1804-ds.xml
├── ssg-ubuntu2204-ds.xml
├── ssg-ubuntu2404-ds.xml
├── ssg-debian12-ds.xml
├── ssg-almalinux9-ds.xml
├── ssg-opensuse-ds.xml
└── ...

The LinuxWrapper.find_content_path() method searches for the matching content file based on the detected OS.

2. Scan Execution¶

oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results /path/to/results.xml \
  --report /path/to/report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

3. Output Parsing¶

CISentinel parses the XML results to extract: - rule-result elements with result='pass' or result='fail' - Rule IDs and severity levels - Total pass/fail counts for the summary table

Installation per Distro¶

Verification¶

CISentinel verifies OpenSCAP differently from other tools — it doesn't just check that oscap exists, it also verifies that SSG content is available:

# From core/tool_manager.py
if tool_name == "openscap":
    content_path = wrapper.find_content_path()
    if content_path:
        return True  # Both binary and content present
    else:
        return False  # Binary exists but no content

Output Artifacts¶

Common Issues¶