https://www.redhat.com/en/blog/center-internet-security-cis-compliance-red-hat-enterprise-linux-using-openscap

Install the package scap-security-guide to check compliance and remediation

Get more information on the profile related to CIS, using the profile id (visible after the Title in the ssg-rhel8-ds.xml file): xccdf_org.ssgproject.content_profile_cis

oscap info --profile xccdf_org.ssgproject.content_profile_cis /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Generate a result file and a html report using OpenSCAP scanner tool, CIS Benchmark version 1.0.0

oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --results scan_results.xml --report scan_report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

/usr/share/scap-security-guide/ansible/
/usr/share/scap-security-guide/bash/
/usr/share/scap-security-guide/kickstart/

Remediate using ansible

oscap xccdf generate fix --fix-type ansible --output PlaybookToRemediate.yml --result-id "" scan_results.xml