Thank you, Ondrej. Works as promised.
But now I have a bunch of hosts that need remediation. (I used the PCI policy.)
The reports provide Remediation Shell Scripts.
I am assuming that there is a way to have them run at scan time? Auto-run?
I’m sure a lot of this could be done via puppet, but that seems like a lot of work.
Perhaps someone has already done all of the heavy lifting. No need to reinvent that wheel …
Is there OpenSCAP support for Debian 9?