What is SCAP Workbench?
|The old workbench scanning a local machine|
Why the rewrite? The workbench is perfect!
- openscap from git
Using the oscap tool for all scanning
Previously, we used the openscap library’s API to perform the scan. That is done using the oscap scanner in the new version. There are several reasons why this is a good idea. For one we can have just one heavily tested code that does evaluation and rely on it for both tools. Also if the oscap scanner gets certified the workbench ends up using a certified scanner which may be valuable for users. 
High level API from openscap
This is done for the workbench to be less likely to break with openscap API changes. The old workbench used to suffer very frequently from this.
Old workbench can only scan the machine it was running on. The new workbench allows users to scan any remote machine with accessible ssh. It will ssh into a remote machine and run oscap there. oscap scanner must be installed on that machine in order to do that.
Results are fetched back to the machine with workbench for analysis.
SCAP Workbench used to only support XCCDF. The prototype allows you to open a source datastream and select any checklist inside. Going forward, datastreams are the preferred way of exchanging SCAP content so it is essential that workbench supports them.
Workbench did not enable users to fix a system so that a rule passes. Since support for remediation has been added to openscap recently, we can simply use the oscap tool to perform it.
So far only online remediation is implemented for both local and remote scans.
The new workflow
When opened, the application immediately pops a file open window and will close itself if user cancels. A file has to be opened at all times in the new workbench. Majority of the work is done in the main window of the application.
|Datastream opened in the new workbench|
|New workbench scanning|
Results are shown in a separate modal dialog, as is the option to save them in one of the 3 formats.
|SCAP Workbench and its result viewer (uses WebKit)|
Currently, SCAP Workbench doesn’t follow the specification when it comes to XCCDF profile tailoring. It changes profiles directly instead of tailoring them even though the feature is called Tailoring in the tool. The new workbench will work with tailoring files and will correctly inherit the profile to tailor it.
This has been enabled by improvements in openscap that allows profile inheritance and name shadowing.
I need some help
References, further reading
 SCAP Workbench mailing list
 Red Hat OpenSCAP Under Evaluation to Meet SCAP 1.2 NIST Standard