Yah. Openscap is nessus on steroids. I run it on non- region boxes.
Nessus should be able to do the same thing --- assuming joe can install an agent on each
server.
PVS is even more interesting.
https://www.tenable.com/products/nessus/nessus-network-monitor
From: shawn(a)redhat.com
Sent: August 9, 2018 11:15 AM
To: scap-security-guide(a)lists.fedorahosted.org
Reply to: scap-security-guide(a)lists.fedorahosted.org
Subject: "Publish OpenSCAP scan metrics to CloudWatch and optionally send SNS
notifications"
Was told about a project that integrates OpenSCAP scanning into AWS CloudWatch. Thought it
was pretty cool & wanted to share:
Overview
This openscap-aws rpm is intended to be used on CentOS or Red Hat AWS instances and will
configure them to self-scan each day, publish score metrics to CloudWatch and optionally
report any failures to an SNS topic. As the scan score is a percentage of pass/fail
findings and some tests may not be applicable to your environment the use of a tailoring
file to specify which failures have been accepted by your organization makes this much
more effective because then you can require that scans have a 100% score.
Code:
https://github.com/ICFI/openscap-aws
Docs:
https://icfi.github.io/openscap-aws/docs.html
THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION
THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY
RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not
the intended recipient, you are hereby notified that any review, retransmission,
dissemination, distribution, copying, conversion to hard copy, taking of action in
reliance on or other use of this communication is strictly prohibited. If you are not the
intended recipient and have received this message in error, please notify me by return
e-mail and delete or destroy all copies of this message.