This is a pretty newbie question on modifying the checks within SCAP. The rule:
<Rule id="jboss_eap_vendor_supported" severity="high">
...
<oval id="jboss_eap_vendor_supported" value="var_jboss_profile" />
<ref srg="SRG-APP-000456-AS-000266" disa="2605" nist="" stigid="JBOS-AS-000680"/>
</Rule>
checks if a "version.txt" file exists with a version matching a supported release of Red Hat JBoss Enterprise Application Platform. This can be found at
scap-security-guide/jboss_eap6/xccdf/application/eap6.xmlI read the DISA STIG requirement to talk to use of unsupported community JBoss releases such as JBoss AS and WildFly. Use of JBoss community software would be a CAT I finding in the STIG. I created a bash script at the following location to correctly find and identify JBoss community releases: