OpenSCAP Tutorial: Features, Use Cases, How to Get Started

TL;DR, What is OpenSCAP?

OpenSCAP is a NIST-certified, open-source toolkit for maintaining consistent security compliance.

Manually checking systems against standards like PCI DSS or STIG is time-consuming, error-prone, and doesn't scale. To help, OpenSCAP provides automated configuration assessment, vulnerability scanning, and compliance reporting. The toolkit uses machine-readable security policies to eliminate guesswork and offers automated remediation, helping you satisfy audit requirements efficiently.

As an open-source tool based on the Security Content Automation Protocol (SCAP), OpenSCAP provides a standard way to maintain system security across different Linux and UNIX-like platforms.

Expose cloud risks no other tool can

Learn how Wiz Cloud surfaces toxic combinations across misconfigurations, identities, vulnerabilities, and data—so you can take action fast.

Work Email*

First Name*

Last Name*

Country

Phone Number*

Company*

Keep me updated about Wiz product releases, industry news, and events (You can unsubscribe at any time)

Subscribe me to the Wiz blog digest emails

Submit

For information about how Wiz handles your personal data, please see our Privacy Policy.

Your work email here

Get a demo

At-A-Glance

• URL: https://github.com/OpenSCAP/openscap

• License: LGPL-2.1

• Primary Language: XSLT

• Stars: 1.6k

• Last Release: 1.4.2

• Topics/Tags: scap, nist, security, compliance, vulnerability-scanning

Common use cases

1. Continuous Compliance Monitoring: You can use OpenSCAP in automated workflows to continuously scan your infrastructure against security baselines like CIS or STIG. Regular scans detect configuration drift, and results can be integrated with alerting or remediation tools so you can maintain a consistent, audit-ready security posture with minimal manual work.

2. CI/CD Pipeline Security Gates: In a DevSecOps pipeline, OpenSCAP scans container images (via oscap-docker or Podman integration) and VM templates during the build phase. The tool acts as an automated security gate, failing builds if policy violations are detected and embedding compliance checks early in the development lifecycle.

3. Automated Audit Preparation: For audits like PCI DSS or HIPAA, OpenSCAP automates evidence collection and generates detailed, standards-specific compliance reports. These reports provide auditors with verifiable proof of control implementation, which simplifies audit preparation and reduces manual effort.

4. Incident Response Forensics: During a security incident, responders use OpenSCAP to scan a compromised system against a trusted baseline. A scan quickly identifies unauthorized changes or misconfigurations relative to policy content, providing crucial data for forensic analysis and containment.

5. Enterprise-Scale System Hardening: When managed with tools like Ansible, OpenSCAP enforces security policies across thousands of systems. The toolkit scans the fleet against a central baseline, reports on deviations, and can apply available remediation scripts to ensure uniform security hardening at scale.

How does OpenSCAP work?

OpenSCAP starts a scan when you select a security policy, like a profile from the SCAP Security Guide. The oscap tool manages the process by loading the security rules you chose. During the scan, check engines review your system’s configuration against these rules, using probes to gather data from places like the file system and system settings. Finally, OpenSCAP gathers the findings, scores them, and creates standard reports in HTML, XML, and ARF (Asset Reporting Format) for compliance checks or use with monitoring dashboards.

• Modular Check Engines: OpenSCAP uses specialized engines like OVAL to evaluate system state, XCCDF to process security checklists, and SCE to run custom validation scripts.

• Content-Driven Scanning: Standardized SCAP content guides each scan. XCCDF profiles define security benchmarks and reference OVAL definitions that contain the detailed check logic.

• System Data Collection: To gather evidence, OpenSCAP uses probes to inspect the target system's live state, including files, processes, network settings, and registry entries.

• Standardized Reporting: OpenSCAP compiles results into an Asset Reporting Format (ARF) file. You can then change the ARF file into user-friendly HTML reports or export results as machine-readable XML data.

Core Capabilities

1. Multi-Standard Compliance Assessment: OpenSCAP automates security evaluation against frameworks like DISA STIG and CIS Benchmarks. It processes XCCDF profiles to check configurations against hundreds of rules, giving you detailed explanations and remediation guidance. Using OpenSCAP enables you to manage your compliance posture against multiple regulatory requirements from a single platform, offering clear, evidence-based scores and gap analyses for system hardening.

2. Vulnerability Scanning and Assessment: OpenSCAP uses the OVAL standard for vulnerability detection across operating systems and applications. It identifies known flaws by checking software versions against CVE databases and pinpoints insecure configurations. By providing detailed impact reports, the tool helps you prioritize remediation efforts and gives you a clear view of system security by combining vulnerability scanning with policy enforcement.

3. Automated Remediation and Hardening: OpenSCAP generates executable remediation scripts in formats like Bash and Ansible directly from scan results, automating the process of fixing compliance issues. The tool creates tailored scripts that you can apply. Automated remediation significantly reduces the manual effort needed to maintain secure and consistent configurations, minimizing human error across large-scale environments.

4. Comprehensive Reporting and Documentation: OpenSCAP produces detailed, multi-format reports, including HTML dashboards and machine-readable ARF/XML for SIEM integration. The reports contain executive summaries, granular technical findings, collected evidence, and actionable remediation steps. The tool's customizable engine ensures all stakeholders receive relevant, data-driven insights, which helps with clear communication and informed decision-making about your security posture.

5. Enterprise Integration and Orchestration: OpenSCAP supports large-scale, orchestrated scanning across thousands of endpoints, with results gathered in central consoles like Red Hat Insights. An integration like this enables you to implement security as code, automate compliance checks, and manage policy enforcement at scale.

Limitations

1. Content-Dependent Accuracy: OpenSCAP’s effectiveness is entirely dependent on the quality and currency of the underlying SCAP security content. Outdated profiles can lead to false positives or leave critical vulnerabilities undetected, creating a false sense of security.

2. Steep SCAP Learning Curve: Effective customization requires understanding the complex XCCDF and OVAL standards. The complexity presents a steep learning curve for teams unfamiliar with the SCAP ecosystem, which can slow down initial adoption and content development.

3. Primarily Linux-Focused: While the SCAP standard is platform-agnostic, the OpenSCAP toolchain, available content, and integrations are heavily optimized for Linux. Robust support and remediation for Windows or macOS environments are much less mature.

4. Performance Overhead on Targets: Full system scans can be CPU and I/O intensive, potentially impacting the performance of production systems. You must carefully schedule scans during off-peak hours to avoid disrupting business-critical applications.

5. Lacks Application-Specific Context: OpenSCAP validates OS and platform configurations but generally lacks awareness of custom application logic. OpenSCAP may miss application-level vulnerabilities or recommend hardening that inadvertently breaks bespoke software dependencies, requiring manual validation.

Getting Started

Step 1: Install OpenSCAP. On most Linux distributions, use your package manager:

For Fedora/RHEL (dnf):

sudo dnf install openscap scap-security-guide

For Debian/Ubuntu (apt):

sudo apt-get install openscap-utils ssg-base

Step 2: Verify the installation.

oscap --version

Step 3: Validate a SCAP data stream.

oscap ds sds-validate scap-ds.xml

Replace scap-ds.xml with a data stream from the SCAP Security Guide (for example):

/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Step 4: Perform your first OVAL scan (example: PCI-DSS profile).

oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \
  --results results.xml \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Step 5: Explore further commands and use cases
Check the OpenSCAP manual for additional options:

man oscap

FAQ

Verified OpenSCAP User Reviews

Positive Reviews

Reddit

• "I used OpenSCAP in a job where we had PCI DSS compliance and yearly audits... it was easy to have the html report to show to the auditors that we had a build standard on them, as that was one of the PCI audit points." - chesty_bonds - r/redhat

• "Yes, I design the Linux OS standards for my company and use them in kickstart to set CIS level 2 compliance then push through Ansible automation to get to ca. 99% there... OpenSCAP does give a nice easy-to-understand HTML report. And if you use it in kickstart it leaves one in the /root folder for you." - [deleted] - r/redhat

Negative Reviews

Reddit

• "Well I was using a CIS script someone put together for CentOS 7 on My CentOS Stream 9 server and that left the server functional, but when I ran the OpenSCAP remediation it broke things. Basic things like file permissions, I turned off SELinux and still no dice. Apparently, there is no rollback so I am dependent on a restore or a snapshot." - SecretaryPhysical463 - r/redhat

• "I used openscap to make a shell script (openscap make a audit/script off the system you have now for hardening) and then I ran it. It wasnt that big of a deal, because I was doing it on a VM and had a snapshot, but every time, it fails."- Moonstone459 - r/AlmaLinux

Alternatives