[Open-scap] Using OpenSCAP for vulnerability assessment

[Luther Goh Lu Feng]

I see that OpenSCAP has a vulnerability assessment function[1]. I wish to confirm if this functionality is present in the SCAP Workbench?


I would like to know OpenSCAP compares with other tools like OpenVAS[2] and Vuls[3] in vulnerability assessment of existing software. Are they an apple to apple comparison?

Please do assume I know very little about the usual security jargon. Am still trying to wrap my head around the acronyms[4] used in the domain and how they relate to each other. Thanks.

--Luther


[1] https://www.open-scap.org/resources/documentation/perform-vulnerability-scan-of-rhel-6-machine/
[2] http://www.openvas.org
[3] https://github.com/future-architect/vuls
[4] https://www.open-scap.org/resources/acronyms/