SCAP Content for Other RPM distributions

This article will describe how to modify the SCAP content provided by DISA to work with RedHat clones such as CentOS and Scientific Linux.  A similar procedure might work for other SCAP content provided by other vendors. Note that the SCAP content is not provided by BMC and BMC is only the engine that runs the SCAP checks against your target systems with the content provided by the particular vendor - eg DISA, CIS, Mitre, NIST, etc.  The example below is for Scientific Linux 6.

The first step is to download your SCAP bundle and extract the zip file.  For the DISA content that should leave you with four files:

U_RedHat_5-V1R1_STIG_Benchmark-cpe-dictionary.xml

Modify

to look like this:

For CentOS you can use  cpe:/o:centos:centos:6
For Fedora you can use cpe:/o:fedoraproject:fedora:17

Obviously you can replace the version to match your environment.  We will use this string later in the other files.  

U_RedHat_5-V1R1_STIG_Benchmark-cpe-oval.xml

Modify this section:

to be:

then:

For Fedora you should use fedora-relase and for CentoOS you should use centos-release instead of sl-release.

and

to

U_RedHat_5-V1R1_STIG_Benchmark-oval.xml

No modifications.

U_RedHat_5-V1R1_STIG_Benchmark-xccdf.xml

In the line that starts with:

change the RHEL_5_STIG to SL_6_STIG so the name of the benchmark will be correct in the BSA workspace

also change the line:

to

Then import the xccdf as normal into the BladeLogic GUI and you can target your 'Other' RPM distributions like CentOS and SL.