OVAL® International in scope and free for public use, OVAL is an information security community effort to standardize how to assess and report upon the machine state of computer systems. OVAL includes a language to encode system details, and an assortment of content repositories held throughout the community.

Tools and services that use OVAL for the three steps of system assessment — representing system information, expressing specific machine states, and reporting the results of an assessment — provide enterprises with accurate, consistent, and actionable information so they may improve their security. Use of OVAL also provides for reliable and reproducible information assurance metrics and enables interoperability and automation among security tools and services.

	Related Efforts Vulnerabilities (CVE) Configurations (CCE) Platforms (CPE) Software Weakness Types (CWE) Attack Patterns (CAPEC) Cyber Observables (CybOX) Checklist Language (XCCDF) Log Format (CEE) Malware (MAEC) Security Content Automation (SCAP) Build Security In Making Security Measurable

Focus On

OVAL Version 5.10.1

Version 5.10.1 of OVAL is now available. Release highlights include adding the missing extended_name entity to the linux-def:rpmverifypackage_state; fixing the minOccurs attribute on the entities in the linux-def:rpmverifypackage_object and linux-def:rpmverifyfile_object so that they are required; and updating the schema_version entity, in the oval:GeneratorType, so that it aligns with the new three-component version identifier in the OVAL Language Versioning Policy. A complete list of changes for Version 5.10.1 is available on the Version 5.10.1 page.

Visit the OVAL Language section for additional information on this and upcoming versions.

Page Last Updated: January 27, 2012