Would need to understand where the content is coming from. Perhaps scap-security-guide in
RHEL, and if so, what RHEL and SSG version?
Note red hat doesn’t publish rhel6 content in the National Checklist Program since rhel6
is out of active maintenance:
Once the content source/version version is identified , the content can be ran through the
NIST content validator tooling to see if there are problems with the content itself.
On Apr 29, 2019, at 11:19 AM, Jan Cerny <jcerny(a)redhat.com>
I have no idea. Does Nessus have any "verbose" mode to get more
helpful error message?
Including scap-security-guide list in this conversation because there
might be people familiar with using SSG with Nessus.
> On Mon, Apr 29, 2019 at 4:54 PM Riaz Ebrahim <mriazebrahim1(a)gmail.com> wrote:
> Hi Jan Cerny,
> Thanks a lot for your response, Your answer was very useful to understand about SSG
files. As per your advice i tried with scap-security-guide-0.1.43-oval-510.zip and XML
validation error was gone, but encountering new error as below from nessus
> "ssg-rhel6-ds-1.zip : Default namespace not found in OVAL"
> Do you get any clue by seeing this error?. Thanks in advance :)
>> On Mon, Apr 29, 2019 at 2:44 PM Jan Cerny <jcerny(a)redhat.com> wrote:
>> I will try to answer, but I don't use Nessus, so I'm not sure what is
>> the exact reason of this fail.
>> In general, the SSG files are validated against SCAP XML schemas, so
>> they are valid SCAP content.
>> However, SCAP standard consist of multiple separate specifications.
>> Strictly speaking, the SSG datastream
>> doesn't conform to SCAP 1.2 specification, because the datastream
>> contains OVAL checks conforming to OVAL
>> version 5.11 which is a part of SCAP 1.3. For SCAP 1.2 conformance it
>> would need to use OVAL checks
>> in version 5.10 or older.
>> According to this forum thread, it seems that Nessus doesn't support
>> OVAL 5.11 it yet, but they say it's planned to be updated
>> It could be a problem that Nessus expects datastreams that contain
>> OVAL 5.10 only.
>> Try using the SSG datastreams that contain OVAL 5.10 only. They can be
>> downloaded from
>> I hope Nessus should be able to consume these files.
>> The reason why we use 5.11 is that it contains new checks that allows
>> us to check easily system services using systemd
>> and other new things introduced in RHEL 7. The aforementioned
>> datastreams that contain OVAL 5.10 only
>> have limited abilities in comparison with those containing OVAL 5.11.
>> Best Regards
>> Jan Černý
>> Security Technologies | Red Hat, Inc.
>>> On Sat, Apr 27, 2019 at 6:34 AM Riaz Ebrahim <mriazebrahim1(a)gmail.com>
>>> I need help on openscap SSG project.
>>> I am currently exploring SCAP Auditing feature from Nessus console. I
understood that Nessus supports SCAP Content (1.0 or 1.1 or 1.2) which can be downloaded
from NIST repository (https://nvd.nist.gov/ncp/repository
) based on the target host
version. This works great, However when i use SCAP from OpenSCAP SSG (example
"ssg-rhel6-ds.xml”), i am getting error as “sg-rhel6-ds. .zip : sg-rhel6-ds.xml
failed XML Schema validation” .
>>> I would like to what is the difference between openSSG scap data stream &
scap1.2 content downloaded from NIST repository. How i can convert openssg data stream
(Example - ssg-rhel6-ds.xml) to NIST scap 1.2 format.
>>> My objective - To use openscap SSG from Nessus. Nessus scap scanning expects
SCAP 1.0, 1.1 or 1.2 content(in zip format).
>>> Thanks in advance!
>>> Open-scap-list mailing list
Security Technologies | Red Hat, Inc.
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines