Usage of SCE

[Yesser-Belhajali]

Hello everyone,I have a question concerning the testing in the SCAP content,do you still implement usage of SCE or any other check engines or are tests conducted exclusively using OVAL files,I need this for a project using SCAP and openscap to figure out wether engine_plugins would be necessary or no,because after analysis i figured that openscap primarly uses oval definition for testing and that engine_plugins is openscap relying on engines other than OVAL to conduct testing and that one of these engines could be SCE which is basically scripts written in python or other languages to test for compliance os such,so if SCE is no longer used it would be unnecessary to use the engine_plugins.
So my question is are tests written in the SCAP content written only in OVAL or are there any other type of documents used?
Any help or clarification would be greatly appreciated,have a great day

[Mab879]

The content in this repo contains a mix of SCE and OVAL checks. We primarily use OVAL, but there is some SCE checks. While SCE isn't SCAP 1.3 compliant we found it useful in some cases. I expect the number of SCE rules grow over time.

OpenSCAP can scan using SCE provided you have the correct packages installed. On RHEL/Fedora based distributions it is usually openscap-engine-sce.

[Yesser-Belhajali]

Hello there,thanks for your response.
So what you mean to say is that the content produced is mainly OVAL for testing?
So i can be sure that every DataStream content can be fully tested with only OVAL engines,but you sometimes publish SCE content.
so if i plan on using SSG i can only rely on OVAL right?

[Mab879]

All data streams by default for RHEL (maybe other products, but not all) build SCE in by default in this project. However, using SCE scanning is opt-in. For example, if you install openscap-scanner on RHEL you will not get openscap-engine-sce by default and only use OVAL checks.