@@ -33,7 +33,7 @@ For more information about the {suse} Security Team, see https://www.suse.com/s
3333
3434
3535
36- == Prepare Clients for an SCAP Scan
36+ == Prepare clients for an SCAP scan
3737
3838Before you begin, you need to prepare your client systems for SCAP scanning.
3939
@@ -90,7 +90,7 @@ For Non-{suse} operating systems the included profiles are community supplied.
9090They are not officially supported by {suse}.
9191====
9292
93- == OpenSCAP Content Files
93+ == OpenSCAP content files
9494
9595OpenSCAP uses SCAP content files to define test rules.
9696These content files are created based on the XCCDF or OVAL standards.
@@ -173,24 +173,33 @@ Take a note of the file paths and profiles for performing the scan.
173173
174174
175175
176- == Perform an Audit Scan
176+ == Perform an audit scan
177177
178178When you have installed or transferred your content files, you can perform audit scans.
179179Audit scans can be triggered using the {productname} {webui}.
180180You can also use the {productname} API to schedule regular scans.
181181
182- .Procedure: Running an Audit Scan from the {webui}
182+ .Procedure: Running an audit scan from the {webui}
183+ [role=procedure]
184+ _____
185+
183186. In the {productname} {webui}, navigate to menu:Systems[Systems List] and select the client you want to scan.
187+
184188. Navigate to the [guimenu]``Audit`` tab, and the [guimenu]``Schedule`` subtab.
189+
185190. In the [guimenu]``Path to XCCDF Document`` field, enter the parameters for the SCAP template and profile you want to use on the client.
186191 For example:
192+
187193+
188- ----
189- Command: /usr/bin/oscap xccdf eval
190- Command-line arguments: --profile xccdf_org.ssgproject.content_profile_stig
191- Path to XCCDF document: /usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml
192- ----
194+
195+ * [literal]``Command``: /usr/bin/oscap xccdf eval
196+
197+ * [literal]``Command-line arguments``: --profile xccdf_org.ssgproject.content_profile_stig
198+
199+ * [literal]``Path to XCCDF document``: /usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml
200+
193201+
202+
194203[NOTE]
195204====
196205If you use [literal]``--fetch-remote-resources`` parameter a lot of RAM is required.
@@ -199,6 +208,7 @@ In addition, you may need to increase the value of [literal]``file_recv_max_size
199208
200209. The scan runs at the client's next scheduled synchronization.
201210
211+ _____
202212
203213[IMPORTANT]
204214====
@@ -207,11 +217,17 @@ If the content file includes invalid arguments, the test fails.
207217====
208218
209219
210- .Procedure: Running an Audit Scan from the API
220+ .Procedure: Running an audit scan from the API
221+ [role=procedure]
222+ _____
223+
211224. Before you begin, ensure that the client to be scanned has Python and XML-RPC libraries installed.
225+
212226. Choose an existing script or create a script for scheduling a system scan through ``system.scap.scheduleXccdfScan``.
213227 For example:
228+
214229+
230+
215231----
216232#!/usr/bin/python3
217233import xmlrpc.client
@@ -222,18 +238,25 @@ client.system.scap.scheduleXccdfScan(key, <1000010001>,
222238 '--profile <profile_name>')
223239client.auth.logout(session_key)
224240----
241+
225242+
243+
226244In this example:
245+
227246* ``<1000010001>`` is the system ID (sid).
247+
228248* ``<path_to_xccdf_file.xml>`` is the path to the content file location on the client.
229249 For example, [path]``/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml``.
250+
230251* ``<profile_name>`` is an additional argument for the [command]``oscap`` command.
231252 For example, use ``united_states_government_configuration_baseline`` (USGCB).
253+
232254. Run the script on the client you want to scan, from the command prompt.
233255
256+ _____
234257
235258
236- == Scan Results
259+ == Scan results
237260
238261
239262Information about the scans you have run is in the {productname} {webui}.
@@ -294,6 +317,7 @@ For more information, see xref:administration:ansible-setup-control-node.adoc[].
294317Packages, channels and scripts are different for each operating system and distribution.
295318Examples are listed in the <<scripts-for-os-types>> section.
296319
320+
297321==== Run the Bash script on single systems as a remote command
298322
299323Run the Bash script as a remote command on single systems.
0 commit comments