RedHat port grabbing can give false positives through backporting. We'd like to make nmap OVAL compatible through the NSE. There is more info on RH an OVAL compatibility. RH has oscap, but it'd be nice to use the same tool. We'd need direct access to the box.