I am reviewing OVAL's in our scanner and determining whether they are relevant anymore and/or even accurate for their intended purpose. Many of the OVAL's I have come across so far are simply looking for a Windows based OS, then looking in the registry for a value in the installed applications hive, and the value for start type. This type of OVAL was used in the past to validate if an application was installed. However it is not a valid check for if the application is running or running properly.
I am curious to know if anyone using Qualys in their enterprise environment has had any successful use cases with OVAL's and what they were used for.