diff --git a/tests/probes/CMakeLists.txt b/tests/probes/CMakeLists.txt
index 95217ab099..058f10062b 100644
--- a/tests/probes/CMakeLists.txt
+++ b/tests/probes/CMakeLists.txt
@@ -25,3 +25,4 @@ add_subdirectory("systemdunitproperty")
add_subdirectory("textfilecontent54")
add_subdirectory("uname")
add_subdirectory("xinetd")
+add_subdirectory("yamlfilecontent")
diff --git a/tests/probes/yamlfilecontent/CMakeLists.txt b/tests/probes/yamlfilecontent/CMakeLists.txt
new file mode 100644
index 0000000000..7497788f0b
--- /dev/null
+++ b/tests/probes/yamlfilecontent/CMakeLists.txt
@@ -0,0 +1,5 @@
+if(ENABLE_PROBES_INDEPENDENT)
+ add_oscap_test("test_probes_yamlfilecontent_key.sh")
+ add_oscap_test("test_probes_yamlfilecontent_array.sh")
+endif()
+
diff --git a/tests/probes/yamlfilecontent/openshift-logging.yaml b/tests/probes/yamlfilecontent/openshift-logging.yaml
new file mode 100644
index 0000000000..a89e709421
--- /dev/null
+++ b/tests/probes/yamlfilecontent/openshift-logging.yaml
@@ -0,0 +1,40 @@
+apiVersion: "logging.openshift.io/v1alpha1"
+kind: "LogForwarding"
+metadata:
+ name: instance
+ namespace: openshift-logging
+spec:
+ disableDefaultForwarding: true
+ outputs:
+ - type: "elasticsearch"
+ name: elasticsearch
+ endpoint: elasticsearch.openshift-logging.svc:9200
+ mode: 066
+ secret:
+ name: fluentd
+ - type: "elasticsearch"
+ name: elasticsearch-insecure
+ endpoint: elasticsearch-insecure.svc.messaging.cluster.local
+ mode: "066"
+ insecure: true
+ - type: "forward"
+ name: secureforward-offcluster
+ endpoint: https://secureforward.offcluster.com:9200
+ mode: "067"
+ secret:
+ name: secureforward
+ pipelines:
+ - inputSource: "hello"
+ - name: container-logs
+ inputSource: logs.app
+ outputRefs:
+ - elasticsearch
+ - secureforward-offcluster
+ - name: infra-logs
+ inputSource: logs.infra
+ outputRefs:
+ - elasticsearch-insecure
+ - name: audit-logs
+ inputSource: logs.audit
+ outputRefs:
+ - secureforward-offcluster
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh
new file mode 100755
index 0000000000..fd5e475381
--- /dev/null
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+. $builddir/tests/test_common.sh
+
+function test_probes_yamlfilecontent_array {
+
+ probecheck "yamlfilecontent" || return 255
+
+ local ret_val=0
+ local DF="${srcdir}/test_probes_yamlfilecontent_array.xml"
+ local RF="results.xml"
+
+ [ -f $RF ] && rm -f $RF
+
+ cp "${srcdir}/openshift-logging.yaml" /tmp
+
+ local YAML_FILE="/tmp/openshift-logging.yaml"
+
+ $OSCAP oval eval --results $RF $DF
+
+ if [ -f $RF ]; then
+ verify_results "def" $DF $RF 2 && verify_results "tst" $DF $RF 3
+ ret_val=$?
+ else
+ ret_val=1
+ fi
+
+ rm -f $YAML_FILE
+
+ return $ret_val
+}
+
+test_probes_yamlfilecontent_array
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.xml b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.xml
new file mode 100644
index 0000000000..666f6e1598
--- /dev/null
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_array.xml
@@ -0,0 +1,99 @@
+
+
+
+
+ yamlfilecontent
+ 1.0
+ 5.11.3
+ 2020-02-13T00:00:00-00:00
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .spec.outputs[2].name
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .spec.outputs[0:2].name
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .spec.outputs[0]
+
+
+
+
+
+
+
+ secureforward-offcluster
+
+
+
+
+
+
+
+
+
+
+
+
+
+ elasticsearch|elasticsearch-insecure
+
+
+
+
+
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh
new file mode 100755
index 0000000000..300c1b496a
--- /dev/null
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+. $builddir/tests/test_common.sh
+
+function test_probes_yamlfilecontent_key {
+
+ probecheck "yamlfilecontent" || return 255
+
+ local ret_val=0
+ local DF="${srcdir}/test_probes_yamlfilecontent_key.xml"
+ local RF="results.xml"
+
+ [ -f $RF ] && rm -f $RF
+
+ cp "${srcdir}/openshift-logging.yaml" /tmp
+
+ local YAML_FILE="/tmp/openshift-logging.yaml"
+
+ $OSCAP oval eval --results $RF $DF
+
+ if [ -f $RF ]; then
+ verify_results "def" $DF $RF 3 && verify_results "tst" $DF $RF 4
+ ret_val=$?
+ else
+ ret_val=1
+ fi
+
+ rm -f $YAML_FILE
+
+ return $ret_val
+}
+
+test_probes_yamlfilecontent_key
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.xml b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.xml
new file mode 100644
index 0000000000..f055bb648b
--- /dev/null
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_key.xml
@@ -0,0 +1,108 @@
+
+
+
+
+ yamlfilecontent
+ 1.0
+ 5.11.3
+ 2020-02-13T00:00:00-00:00
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .kind
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .metadata.namespace
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .metadata
+
+
+
+ /tmp
+ openshift-logging.yaml
+ .doesnt.exist
+
+
+
+
+
+
+
+ LogForwarding
+
+
+
+ openshift-logging
+
+
+
+
+