1

I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation.

I receive a lot of these warnings when evaluating my Windows 10 hosts:

W: C:\Program Files (x86)\OpenSCAP 1.3.1\oscap.exe: Obtrusive data from probe!

You can see the console output of one test evaluation below: https://pastebin.com/sZZcBjs3. There were 213 definitions and 82 obtrusive data warnings. Whenever these warnings are written to the console it seems to hang for a while, taking a significant time before moving on to the next evaluation. This evaluation of 213 definitions took 58 minutes:

PS C:\Windows\system32> measure-command {

    $OpenSCAPLocation = [string](Get-ChildItem HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall | ForEach-Object { Get-ItemProperty $_.PsPath } | Select-Object DisplayName, InstallLocation | Where-Object{$_.DisplayName -eq "OpenSCAP"}).InstallLocation
    Start-Process -NoNewWindow -Wait -WorkingDirectory $OpenSCAPLocation -FilePath "oscap" -ArgumentList "oval eval --results `"C:\Program Files (x86)\OpenSCAP 1.3.1\results-def3.xml`" `"C:\wamp64\www\definition_files\w10_definitions_1.xml`""

}


Days              : 0
Hours             : 0
Minutes           : 58
Seconds           : 52
Milliseconds      : 187
Ticks             : 35321878555
TotalDays         : 0.0408818038831019
TotalHours        : 0.981163293194444
TotalMinutes      : 58.8697975916667
TotalSeconds      : 3532.1878555
TotalMilliseconds : 3532187.8555

I've searched high and low for information on this warning but can't find anything useful. The best I could find was this issue: https://github.com/OpenSCAP/openscap/issues/1394

  • What does this warning actually mean?
  • Is there somewhere I can read up on the cause and resolution?
  • Is it something I should even worry about, or just an expected warning (at this frequency)?

Loving OpenSCAP so far, excited to see how it progresses with Windows this year!

Thanks!

Arbiter
  • 141
  • 3

0 Answers0