{"id":"50ba458a-6a78-4eb0-b589-09939b7208f1","task":"Automate CIS Benchmark auditing of a Linux host using OpenSCAP and the SCAP Security Guide content","domain":"open-scap.org","steps":["Install the openscap-scanner package (the oscap CLI) and the distribution's SCAP Security Guide (SSG) content package, which ships datastream XML files mapping to CIS, STIG, and other profiles for that OS release.","List available profiles in the datastream with oscap info <ssg-datastream.xml> to find the exact CIS profile ID for your OS version.","Run oscap xccdf eval --profile <cis-profile-id> --results results.xml --report report.html <ssg-datastream.xml> to evaluate every rule in the profile against the live system.","Review the generated HTML report for pass/fail/not-applicable results per control, optionally applying SSG-provided Ansible or Bash remediation content for failing controls.","Schedule the scan via cron, a systemd timer, or a config-management job, and archive the results.xml artifacts as compliance evidence over time."],"gotchas":["SSG profile IDs and rule coverage are versioned per OS release — a datastream built for one major OS version won't have the same profile ID or full rule set as another, so pin the SSG package version to your OS.","Not every CIS control has an automatable SCAP check; some requirements are inherently manual (physical security, process controls) and simply won't appear as pass/fail.","Automated remediation scripts can change system behavior (e.g., disabling services or ports) and should be tested in a non-production environment first."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/50ba458a-6a78-4eb0-b589-09939b7208f1"}