-
The ruleType allows for an impact-metric element for representing a CVSS 2.0 base vector. The element has been marked as deprecated as the “property was found to be of little use in the anticipated X…
-
Sometimes an XCCDF rule contains different requirements based on the target platform, and it would be useful to be able to select a single check-content-ref to perform based on the outcome of XCCDF's …
-
SCAP and XCCDF content may be considered sensitive information and require security markings. For instance, in the case of DISA STIGs, some documents contain Controlled Unclassified Information (CUI).…
-
https://static.open-scap.org/ssg-guides/ssg-chromium-guide-stig.html#xccdf_org.ssgproject.content_rule_chromium_disable_3d_graphics_api
-
In order to separate out results at a more granular level, for certain technologies such as database instances, databases, webservers, websites, containers, I am proposing that XCCDF be updated to con…
-
Some policies are written which to not clearly define the exact requirement to be verified, but state things such as "verify that the database owner matches system documentation". Without the ability…
-
#### Description of problem:
Trying to understand why the 'ssg-debderived' package contains configurations up to 22.04, but not for 24.04 (a.k.a. Noble), even though it's been out for six months or…
-
Hello Team,
As pert a our security governance programe, we need to build a hardened docker base os using amazon linux:2. While I could not find any tool or software for this but I found this compli…
-
#### Description of problem:
This rule was introduced by https://github.com/ComplianceAsCode/content/pull/10390.
It is failing after remediation when checking `CIS Server Level 2` profile.
####…
-
#### Description of problem:
All of the scan result using ssg-alinux3-xccdf.xml with profile xccdf_org.ssgproject.content_profile_cis resulting not applicable for all items.
![image](https://githu…