anchor.diff:  $ oscap xccdf eval --results results.xml --report report.html com.redhat.rhsa-all.xccdf.xml
   --------------------------------------------------------------------------------------------
   
  -This is a sample output. It reports that Red Hat Security
  -Advisory (RHSA-2013:0911) was issues but update was not applied so a
  +This is the sample output. It reports that Red Hat Security
  +Advisory (RHSA-2013:0911) was issued but update was not applied so a
   system is affected by multiple CVEs (CVE-2013-1935, CVE-2013-1943,
   CVE-2013-2017)
   
  
positive.code: Result  fail
  ------------------------------------------------------------------------------------
  
  NOTE: Note that these OVAL definitions are designed to only cover software and
  updates released by Red Hat. You need to provide additional definitions in order
  to detect the patch status of third-party software.
  
  
  Human readable report *report.html* is generated by side with "machine"
  readable report **results.xml**. Both files hold information about
  vulnerability status of scanned system. They map RHSA to CVEs and report
  what security advisories are not applied. CVE identifiers are linked
  with National Vulnerability Databases where additional information like:
  CVE description, CVSS score, CVSS vector, etc. are stored.
  
  To find out more information about this project, see
  http://www.redhat.com/security/data/metrics/.
  
negative.code: The Red Hat Security Response Team provides OVAL definitions for all
  vulnerabilities (identified by CVE name) that affect Red Hat Enterprise
  Linux 3, 4, 5, 6 and 7. This enable users to perform a vulnerability scan
  and diagnose whether system is vulnerable or not. The data is provided in
  two formats -- OVAL file, OVAL + XCCDF and a Source DataStream.
  
  ==== OVAL + XCCDF
  
  1)  Download the content
  ---------------------------------------------------------------------------------
  