You have to customize the STIG profile first using scap-workbench, unselect the rules you want to remove and then on the left bottom of scap-workbench's main page you can generate the ansible playbook for this customized profile.

This scap-workbench feature of exporting ansible using custom profile is present on RHEL since 8.3.

Additionally, one quick way of avoiding rules straight from the vanilla ansible playbook is to skip tasks by their tags. Something like:

ansible-playbook ... --skip-tags DISA-STIG-RHEL-08-020290,DISA-STIG-RHEL-08-040135 rhel8-playbook-stig.yml

Regards.

On Thu, May 13, 2021 at 10:44 PM Chris Bidwell - NOAA Federal <chris.bidwell@noaa.gov> wrote:
Is there a way with the scap-workbench output to ansible format...To exclude specific RHEL STIG ID's?  

I've got rhel8-playbook-stig.yml that I'm using for applying my STIG's that I've downloaded from: https://github.com/RedHatGov/rhel8-stig-latest/blob/master/rhel8-playbook-stig.yml

On Wed, Apr 28, 2021 at 3:20 PM Mark Thacker <mthacker@redhat.com> wrote:

Hi there.

Perhaps you are missing the "scap-security-guide" package in RHEL 8.

Here is a link to the documentation in RHEL 8: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/scanning-the-system-for-configuration-compliance-and-vulnerabilities_security-hardening#configuration-compliance-scanning_scanning-the-system-for-configuration-compliance-and-vulnerabilities

On 4/27/21 2:27 PM, MyNicePC wrote:
Hello,

I just installed Openscap Workbench on my laptop. I have apways been able to scan RHEL 6 and RHEL 7 servers using security guides provided within OpenScap. Does anyone know if you support a security guide for RHEL 8?

Thank you,

JR

_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--

Mark Thacker

He/Him

Team Lead & Security Experience Product Manager, Red Hat Enterprise Linux

Red Hat

mthacker@redhat.com   
M: +1-214-636-7004    
Twitter / IRC: @thackman

_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure


--

Chris Bidwell, CISSP
Space Weather Prediction Center
National Oceanic Atmospheric Administration
email: chris.bidwell@noaa.gov
office: 303-497-3204
mobile: 720-496-3126
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure