Understanding OpenSCAP architecture for building a modern web-based compliance auditing interface

[Yesser-Belhajali]

Hello everyone,

First of all, thank you in advance to anyone who takes the time to read this and help me.

I am currently working on a school project that is also related to an internship application I will be making next semester. The goal of the project is to audit a machine, identify security weaknesses, and eventually provide remediation solutions.

I am relatively new to the cybersecurity field, so I have been putting a lot of effort into learning and understanding the different concepts involved. When I came across SCAP, OpenSCAP, and SCAP Workbench, it took me some time to understand the ecosystem and how all the different components fit together (SCAP, XCCDF, OVAL, datastreams, etc.).

SCAP Workbench was very close to what I had in mind, but since it is now in an end-of-life state and no longer actively maintained, I started thinking about building a more modern solution based on the OpenSCAP and SCAP ecosystem.

My idea is to develop a modern web interface where OpenSCAP would act as the compliance scanning engine, while security content such as ComplianceAsCode/SCAP Security Guide would provide the rules, benchmarks, and remediation information.

However, I have been struggling to understand the internal architecture. I have spent time studying XCCDF, OVAL, datastreams, and the OpenSCAP source code. I understand their general purpose and how they are related, but I am having difficulties understanding how everything is connected internally and how the scanning process flows through the codebase.

I would like to better understand:

• How the OpenSCAP architecture is organized internally.
• Where the XCCDF and OVAL processing happens during a scan.
• How datastreams are handled internally.
• How scan results are generated and linked back to individual rules.
• What would be the recommended approach for building an external web interface on top of OpenSCAP.
• Whether it would be better to simply use the OpenSCAP executable/API after building the project, or if modifying parts of the source code would make sense for this type of project.

My goal is not to simply copy existing work, but to properly understand the ecosystem and add my own contribution on top of it.

If anyone could provide guidance, point me toward relevant parts of the codebase or documentation, or explain the general architecture, I would greatly appreciate it.

Thank you very much for your time and for the great work you have already done on these projects.