content

Well there is one available for oscap at https://github.com/ComplianceAsCode/content

There is OpenScap based ComplianceAsCode. See https://github.com/ComplianceAsCode/content It has implementations for CIS Level 1 & 2 benchmark. Supports NIST, ... It allows you to generate ansible or bash scripts for execution. If you install OpenScap it comes with built-in policies, but it's always out of sync with the current version of Ubuntu, which is frustrating first time around. For every version of Ubuntu, the default policies do not work, for e.g. in case of Ubuntu 24.04, I need to download git clone https://github.com/complianceascode/content.git cd content/ and ./build_product ubuntu2404 and cd .. #Run either of the following commands: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level1_server --results arf1.xml --report report1.html content/build/ssg-ubuntu2404-ds.xml oscap xccdf

I cannot speak for AlmaLinux, but it's incorrect to say they're not compatible. They are most definitely still compatible with the upstream distributions. Yes, they have made some changes that make them quite different from the upstreams, but this was their choice and it works for their community and their overall goals. I personally don't see any issues with what they've chosen to do, but that's my extremely narrow view as all clients I work for only use RHEL or Ubuntu. In regards to STIG, this makes me think of the "scap-security-guide" package that helps the openscap package run tests for compliance like PCI-DSS and HIPPA (among other things). While it is true that we mark ourselves as a "derivative" of RHEL in that package, it doesn't mean we have any certifications or the like and we certainly do not claim to have such certifications

This is great https://github.com/ComplianceAsCode/content I use it for regular scanning, flagging potential issues, automatically making changes, aligning images to CIS Level 2, and for ongoing scanning to satisfy SOC2 auditors.