Cross-referencing CCE's and Remediation scripts

Spencer Shimko spencer at
Mon May 19 20:00:34 UTC 2014

On Mon, May 19, 2014 at 3:44 PM, Greg Elin <gregelin at> wrote:
> I've put together a web page to show which RHEL 6 CCE's have a remediation script from Aqueduct and SSG.
> It is interesting that a number of rules are missing CCE Idents. It is also easier to see the coverage of fix scripts.
> Http://
> Would love feedback and thoughts in how to improve coverage.

Thanks Greg!  I was just writing an email inquiring about the status
of remediation in SSG when this hit my inbox.  Eerily coincidental.

To piggy back onto this thread a bit - I see postings with bits and
pieces of the content but I'm looking for a short summary of the
status, this is what we have, this is what is missing, this is what
we're looking for in the short-term.  And, based on Greg's, chart
above there are Aqueduct has remediation content missing from SSG and
SSG has remediation content missing from Aqueduct.  How is this gap
being closed?

In the meantime - how are people STIG'ing a box given the gap in
remediation content?


> Greg Elin
> P: 917-304-3488
> E:  gregelin at
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at

Spencer Shimko

Quark Security, Inc
O: 443-457-8275 x1000
M: 858-877-3623

More information about the scap-security-guide mailing list