Chapter 8. Managing compliance policies
Chapter 8. Managing compliance policies A compliance policy is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content. You specify the schedule for scans on Satellite Server and the scans are performed on hosts. When a scan completes, a report in ARF format is generated and uploaded to Satellite Server. The compliance policy makes no changes to the scanned host. A compliance policy defines a SCAP client configuration and a cron schedule. The policy is then deployed together with the SCAP client on hosts to which the policy is assigned. 8.1. Creating a compliance policy By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies. Prerequisites You have configured Satellite for your selected compliance policy deployment method . You have available SCAP contents, and eventually tailoring files, in Satellite. To verify what SCAP contents are available, see Chapter 6, Listing available SCAP contents . To upload SCAP contents and tailoring files, see Chapter 7, Configuring SCAP contents . Your user account has a role assigned that has the view_policies and create_policies permissions. Procedure In the Satellite web UI, navigate to Hosts > Compliance > Policies . Click New Policy or New Compliance Policy . Select the deployment method: Ansible , Puppet , or Manual . Then click . Enter a name for this policy, a description (optional), then click . Select the SCAP Content and XCCDF Profile to be applied, then click . Note that Satellite does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the Default XCCDF Profile , will return empty reports. Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File , then click . Specify the scheduled time when the policy is to be applied. Select Weekly , Monthly , or Custom from the Period list. The Custom option allows for greater flexibility in the policy's schedule. If you select Weekly , also select the desired day of the week from the Weekday list. If you select Monthly , also specify the desired day of the month in the Day of month field. If you select Custom , enter a valid Cron expression in the Cron line field. Select the locations to which to apply the policy, then click . Select the organizations to which to apply the policy, then click . Optional: Select the host groups to which to assign the policy. Click Submit . 8.2. Viewing a compliance policy You can preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when you plan policies. Prerequisites Your user account has a role assigned that has the view_policies permission. Procedure In the Satellite web UI, navigate to Hosts > Compliance > Policies . In the Actions column of the required policy, click Show Guide or select it from the list. 8.3. Editing a compliance policy In the Satellite web UI, you can edit compliance policies. Puppet agent applies an edited policy to the host on the run. By default, this occurs every 30 minutes. If you use Ansible, you must run the Ansible role manually again or have configured a recurring remote execution job that runs the Ansible role on hosts. Prerequisites Your user account has a role assigned that has the view_policies and edit_policies permissions. Procedure In the Satellite web UI, navigate to Hosts > Compliance > Policies . Click the name of the required policy. Edit the necessary attributes. Click Submit . 8.4. Deleting a compliance policy In the Satellite web UI, you can delete existing compliance policies. Prerequisites Your user account has a role assigned that has the view_policies and destroy_policies permissions. Procedure In the Satellite web UI, navigate to Hosts > Compliance > Policies . In the Actions column of the required policy, select Delete from the list. Click OK in the confirmation message.