1. Install Compliance operator
2. Create a ssb:
$ oc compliance bind -N test -S default-auto-apply profile/rhcos4-stig
3. Rerun the ssb when auto-remediations applied
$ oc compliance rerun-now scansettingbinding test 

Rule rhcos4-audit-rules-login-events-faillock will fail even after auto-remediation applied

$ oc debug node/xiyuan-411-snkwc-worker-westus-1
Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "container-00" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "container-00" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "container-00" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volume "host" uses restricted volume type "hostPath"), runAsNonRoot != true (pod or container "container-00" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "container-00" must not set runAsUser=0), seccompProfile (pod or container "container-00" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
Starting pod/xiyuan-411-snkwc-worker-westus-1-debug ...
To use host binaries, run `chroot /host`
Pod IP: 10.0.1.5
If you don't see a command prompt, try pressing enter.
sh-4.4# chroot /host
sh-4.4# cat /etc/audit/rules.d/75-var_accounts_passwords_pam_faillock_dir_login_events.rules
-w var_accounts_passwords_pam_faillock_dir -p wa -k logins
# cat /etc/audit/rules.d/audit.rules 
## First rule - delete all