G'Morning. New to the list & getting spun up on SSG for RHEL-6. Couple quick questions:

In the current content, the rules fail even if the supporting package is not installed (e.g. shows vulnerable for postfix checks even if postfix is not installed).

1. Are there currently any mappings between OVAL tests and the RPMs that are dependencies (e.g. "test_postfix_server_banner" requires postfix-x-x.rpm to be installed)?  If not, I can start mapping this out in a spreadsheet/CSV to get started.

2. Would the correct way to handle this be in the individual OVAL checks ("AND" the current test and an RPM test for the package)? Or is there a more elegant way to handle this with OVAL_CPE?

Thanks.

~Ed