Custom Scan for Antivirus

[Greek-Fire]

Good morning from Knoxville, TN.

Does anybody have a good example of altering the scan of a STIG Rule? McAfee is EOF for Linux, and I would like to either create a custom rule with a custom scans/OVAL check, or alter the rule that already exists for McAfee.

CCE-83879-7

[Mab879]

Thanks for your question.

If you have the package name of the most current solution it's fairly easy to create a rule for that.

See the package_sudo_installed rule as an example.

If you looking for a more complicated rule, like a service running (that is also easy see service_sshd_enabled) or configure options we can help with that as well.

If you need any help with that let us know.

[Greek-Fire]

Thank you for responding so quickly. I am going to try somethings and report back. when I figure it out, since you all are doing a fantastic job of communicating to your fan base, would there be a place for me to describe the steps to do this in more detail?

[Mab879]

As reply to this discussion is a fine place.

You can also talk to us on Gitter.