So far, we have seen that the OpenSCAP scans, especially the XCCDF-based ones, produce nice, easy-to-read reports that you can easily take action on. However, if the reports are not clear to you, then you would not know what needs fixing to rectify the lack of compliance.
Fortunately, both the OVAL policies we used earlier to check for vulnerable packages and the XCCDF-based reports contain enough information for you to do both things.
Let's take an example from our earlier scan of our CentOS 7 server using the SSG version 0.1.47. In this, we failed, among other things, a check called Disable ntpdate Service (ntpdate). Suppose that this result was not obvious to you, and you were unsure what the underlying problem was or why it was an issue. Fortunately, in the HTML report generated from this scan, you can click on the check title. A screen should pop...