OpenSCAP oscap

oscap xccdf eval --profile cis <ds>

Evaluate the system against a security profile (CIS, STIG) with OpenSCAP, the open-source SCAP audit that generates the compliance report.

Run it when you need a SCAP audit of the system: oscap evaluates the machine against the datastream (ds) with the profiles (CIS, STIG, PCI-DSS) and generates the report with the compliance of each rule — passed, failed, or not applicable. It's the standard for automated configuration auditing: the same engine used by commercial products, in open source. In the hardening program, OpenSCAP is the measurement against the benchmarks: the per-host report (HTML), the prioritized failed controls, and remediation with the same tool (--remediate).

Don't use it without the correct benchmark datastream: oscap needs the datastream .xml file (CIS/STIG ones are downloaded from the vendor) — without the datastream, there's no evaluation. The profiles are generic: controls that don't apply to the role penalize compliance — the profile is chosen based on the host's role. And watch out for automatic remediation (--remediate): it applies changes that can break services — test it in the lab before production, and in production use evaluation first and manual or scheduled remediation. Performance: full evaluation takes time; schedule it in production.