@@ -33,7 +33,7 @@ For more information about the {suse} Security Team, see https://www.suse.com/s
3333
3434
3535
36- == Prepare Clients for an SCAP Scan
36+ == Prepare clients for an SCAP scan
3737
3838Before you begin, you need to prepare your client systems for SCAP scanning.
3939
@@ -90,7 +90,7 @@ For Non-{suse} operating systems the included profiles are community supplied.
9090They are not officially supported by {suse}.
9191====
9292
93- == OpenSCAP Content Files
93+ == OpenSCAP content files
9494
9595OpenSCAP uses SCAP content files to define test rules.
9696These content files are created based on the XCCDF or OVAL standards.
@@ -173,26 +173,33 @@ Take a note of the file paths and profiles for performing the scan.
173173
174174
175175
176- == Perform an Audit Scan
176+ == Perform an audit scan
177177
178178When you have installed or transferred your content files, you can perform audit scans.
179179Audit scans can be triggered using the {productname} {webui}.
180180You can also use the {productname} API to schedule regular scans.
181181
182- .Procedure: Running an Audit Scan from the {webui}
182+ .Procedure: Running an audit scan from the {webui}
183+ [role=procedure]
184+ _____
185+
183186. In the {productname} {webui}, navigate to menu:Systems[Systems List] and select the client you want to scan.
187+
184188. Navigate to the [guimenu]``Audit`` tab, and the [guimenu]``Schedule`` subtab.
189+
185190. In the [guimenu]``Path to XCCDF Document`` field, enter the parameters for the SCAP template and profile you want to use on the client.
186191 For example:
192+
187193+
188194
189195 * [literal]``Command``: /usr/bin/oscap xccdf eval
190-
196+
191197 * [literal]``Command-line arguments``: --profile xccdf_org.ssgproject.content_profile_stig
192-
198+
193199 * [literal]``Path to XCCDF document``: /usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml
194200
195201+
202+
196203[NOTE]
197204====
198205If you use [literal]``--fetch-remote-resources`` parameter a lot of RAM is required.
@@ -201,6 +208,7 @@ In addition, you may need to increase the value of [literal]``file_recv_max_size
201208
202209. The scan runs at the client's next scheduled synchronization.
203210
211+ _____
204212
205213[IMPORTANT]
206214====
@@ -209,11 +217,17 @@ If the content file includes invalid arguments, the test fails.
209217====
210218
211219
212- .Procedure: Running an Audit Scan from the API
220+ .Procedure: Running an audit scan from the API
221+ [role=procedure]
222+ _____
223+
213224. Before you begin, ensure that the client to be scanned has Python and XML-RPC libraries installed.
225+
214226. Choose an existing script or create a script for scheduling a system scan through ``system.scap.scheduleXccdfScan``.
215227 For example:
228+
216229+
230+
217231----
218232#!/usr/bin/python3
219233import xmlrpc.client
@@ -224,18 +238,25 @@ client.system.scap.scheduleXccdfScan(key, <1000010001>,
224238 '--profile <profile_name>')
225239client.auth.logout(session_key)
226240----
241+
227242+
243+
228244In this example:
245+
229246* ``<1000010001>`` is the system ID (sid).
247+
230248* ``<path_to_xccdf_file.xml>`` is the path to the content file location on the client.
231249 For example, [path]``/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml``.
250+
232251* ``<profile_name>`` is an additional argument for the [command]``oscap`` command.
233252 For example, use ``united_states_government_configuration_baseline`` (USGCB).
253+
234254. Run the script on the client you want to scan, from the command prompt.
235255
256+ _____
236257
237258
238- == Scan Results
259+ == Scan results
239260
240261
241262Information about the scans you have run is in the {productname} {webui}.
@@ -296,6 +317,7 @@ For more information, see xref:administration:ansible-setup-control-node.adoc[].
296317Packages, channels and scripts are different for each operating system and distribution.
297318Examples are listed in the <<scripts-for-os-types>> section.
298319
320+
299321==== Run the Bash script on single systems as a remote command
300322
301323Run the Bash script as a remote command on single systems.
0 commit comments