we currently use oscap to run security scans to validate configurations in DISA STIG for our Linux machines. We are seeing a lot of false positives and we are trying to figure out if there is a way to use a tailoring file to update the rule results so that the end results show as "False Positive" and not "Failed".
We want to see if there's a way to do this through a tailoring file so we have some traceability on what rules are being customized in the xccdf document.
Thank you for reading.
