Home STIG questions Why do OpenSCAP results import into STIG Viewer as Not Reviewed?

Why do OpenSCAP results import into STIG Viewer as Not Reviewed?

Last updated on Nov 10, 2026

This article is for users who scan with OpenSCAP (oscap, oscap-podman or oscap-docker) and import the results into a STIG Viewer 3.x checklist. The common symptom is an import that finishes but leaves every rule as Not Reviewed. Some users see "Error parsing XCCDF" instead.

The usual cause

SCAP Security Guide (SSG) 0.1.78 changed the STIG reference URL in its content. Older OpenSCAP releases did not recognize the new URL. When you used the --stig-viewer option, the output file had no rule results that mapped to DISA rule IDs. SSG 0.1.77 results still imported. Users reported the same problem with SSG 0.1.79 on RHEL 8 and RHEL 9, and with container scans.

OpenSCAP fixed this in 1.3.13 for RHEL 8 and RHEL 9 and in 1.4.3 for RHEL 10. Newer releases include the fix.

Steps

  1. Check your OpenSCAP version with oscap --version.
  2. If it is older than 1.3.13 (or 1.4.3 on the 1.4 line), update the openscap-scanner package. If an update is not available yet, scan with SSG 0.1.77 content as a short-term workaround.
  3. Run the scan again with the STIG profile and the --stig-viewer option.
  4. In STIG Viewer, open the checklist. Click the Import icon and select Import XCCDF or CMRS Results.
  5. Select the new results file and click Load.
  6. Read the summary. It shows how many results match on Rule ID and revision, how many match only on Rule ID, and how many did not match at all.
  7. Click Complete Import.

Common problems

  • Results match on Rule ID but not revision. The scan content and the checklist use different STIG releases. Check Include loosely matched results before you click Complete Import, or build the checklist from the same STIG release as the scan content.
  • Many results did not match a Rule ID. Click Show to list them. Make sure the checklist uses the STIG for the scanned operating system.
  • The file still has no results. Open the XML and look for rule-result elements. If there are none, the scanner output is the problem, not STIG Viewer.

Sources